Aggregated from vendor advisories, security research, and industry publications.
In July 2025, someone registered a domain that used to belong to a content delivery network. The CDN had been wound down years earlier, and the domain it served assets from was allowed to expire. What it had not lost were its callers. Thousands of websites, code repositories, and documentation pages still carry hard-coded references to hostnames beneath it. The new owner holds
Anthropic’s recent security-incident document contains a bit about how CAPTCHAs are still frustrating Claude. In the transcript, the Claude model that is so powerful that Anthropic…
A flaw in four widely used AI coding agents lets someone who controls a plugin's code repository swap the plugin an agent installs for a malicious one, even when the agent locked t…
Microsoft fixed vulnerabilities across Azure and AI-branded products, with privilege escalation flaws accounting for the majority. The post Microsoft Patches 18 Vulnerabilities in …
Cybersecurity researchers have discovered a cluster of 13 npm packages that have been found to deliver a previously undocumented JavaScript stealer codenamed WeaselBiscuit. The ne…
AI, Cyber, SAP and Testing teams caught in latest reshaping of Big Four consultancy's Advisory arm
Active since at least 2022, NightmareStresser was one of the longest-running DDoS-for-hire services in the world. The post NightmareStresser DDoS Service Disrupted in International…
Hackers used a compromised API key to deploy a Cloudflare worker that injected malicious scripts. The post Brevo Supply Chain Attack Injects Malware Into 100,000 Websites appeared …
Check Point Software has released security updates to address a critical vulnerability that can let attackers execute code with root privileges on management systems. [...]
Surveillance and training drone systems will come through three UK suppliers, though some are built overseas
A financially motivated threat actor has been linked to the development and distribution of a JavaScript (JS)-based information stealer known as PhantomRaven via the npm package re…
CVE-2026-58138 is an unauthenticated remote code execution vulnerability that attackers can exploit via inline workflow definitions. The post Critical Orkes Conductor Vulnerability…
Whitehall changes a 'big mistake' as anything going in with Business department gets squeezed
Microsoft has fixed a known issue that causes copy-and-paste failures for some Excel users after installing the September 2026 KB5002914 security update. [...]
The company will use the funding to accelerate platform development and expand its presence in key enterprise markets. The post MIND Secures $72 Million for AI-Powered DLP appeared…
Check Point Security Management and Log Servers are affected by a critical vulnerability that can allow remote code execution with root privileges. The post Check Point, Kaspersky,…
AI-driven cyberattacks used to be exotic. Soon, it'll be odd if threat actors aren't using agents to do all of their bidding.
When wires and wireless mix, the combination can be electric
Cybersecurity researchers have flagged a new Android malware called RatHat that's assessed to be operated by China-based threat actors and features an artificial intelligence (AI)-…
RAND wants better data to price machine-made mishaps, apocalypse not included
Improved signup experience for ‘AI builders’ hides complexity and includes spending cap
Think tank points out that companies banned by Washington will help run the regime that Uncle Sam now controls
When enterprise IT calculates the likely environmental and ROI impact from replacing data center systems, it fails to account for much of it, and also tends to discard hardware far…
It might be the next trillion-dollar company, but it'll need some help on the supply side to do it
Plugin4Shell attack affects all the major coding agents, researchers say
A new Android malware called RatHat has been discovered, targeting users with an AI-powered subsystem that helps operators remotely navigate compromised devices. [...]
The move is consistent with the agency's advice on the need for organizations to prioritize the vulnerabilities that actually matter.
Cisco released patches for an actively exploited authentication bypass vulnerability in its Cisco Identity Services Engine (ISE) platform, which is used for enterprise network acce…
960DT is set to arrive early, boasting performance far exceeding anything the West could offer the Middle Kingdom
Entrants get $250K upfront to deliver a demo within a year, which sounds totally feasible given quantum computing's track record